Security audit: fix IDOR, add rate limiting, HMAC auth, token hashing, XSS sanitization

Critical: Add ownership checks to all order routes (IDOR fix).
High: Redis rate limiting on auth endpoints, HMAC-signed internal
service calls replacing header-presence-only checks, nh3 HTML
sanitization on ghost_sync and product import, internal auth on
market API endpoints, SHA-256 hashed OAuth grant/code tokens.
Medium: SECRET_KEY production guard, AP signature enforcement,
is_admin param removal, cart_sid validation, SSRF protection on
remote actor fetch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/requirements.txt

@@ -44,6 +44,7 @@ Werkzeug==3.1.3
 wsproto==1.2.0
 zstandard==0.25.0
 redis>=5.0
+nh3>=0.2.14
 mistune>=3.0
 pytest>=8.0
 pytest-asyncio>=0.23